From bb9e4098c063b7ff69e2ea0ef9bacc725f04e841 Mon Sep 17 00:00:00 2001
From: Yavor16 <yavoruzbg@gmail.com>
Date: Fri, 10 Jul 2026 16:49:16 +0300
Subject: [PATCH 1/5] Bump reactor-netty from 1.2.18 to 1.3.6

Raise the managed reactor-netty version and add explicit managed pins
for reactor-netty-core and reactor-netty-http so every reactor-netty
artifact resolves to a single consistent version instead of leaving the
core/http submodules floating at the cloudfoundry-client transitive
version. Removes the stale property comment that warned against 1.3.x.

JIRA:LMCROSSITXSADEPLOY-3410
---
 pom.xml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3cc3c7a109..b58c275a4c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,8 +37,7 @@
         <liquibase.version>4.33.0</liquibase.version>
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
-        <!--reactor netty 1.3.x uses direct memory leading to OOM errors-->
-        <reactor-netty.version>1.2.18</reactor-netty.version>
+        <reactor-netty.version>1.3.6</reactor-netty.version>
         <!-- Override Netty version to fix CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
         <netty.version>4.1.135.Final</netty.version>
         <swagger.version>1.6.16</swagger.version>
@@ -870,6 +869,16 @@
                 <artifactId>reactor-netty</artifactId>
                 <version>${reactor-netty.version}</version>
             </dependency>
+            <dependency>
+                <groupId>io.projectreactor.netty</groupId>
+                <artifactId>reactor-netty-core</artifactId>
+                <version>${reactor-netty.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.projectreactor.netty</groupId>
+                <artifactId>reactor-netty-http</artifactId>
+                <version>${reactor-netty.version}</version>
+            </dependency>
             <!-- https://mvnrepository.com/artifact/org.cloudfoundry.multiapps/multiapps-common -->
             <dependency>
                 <groupId>org.cloudfoundry.multiapps</groupId>

From d5cd758b79599d0b4067d853e36cade8b3a9f723 Mon Sep 17 00:00:00 2001
From: Yavor16 <yavoruzbg@gmail.com>
Date: Tue, 14 Jul 2026 16:23:34 +0300
Subject: [PATCH 2/5] Bump Netty to 4.2.15.Final to align with reactor-netty
 1.3.6

reactor-netty 1.3.x requires Netty 4.2.x. Align the pinned
netty.version property with the already-bumped reactor-netty 1.3.6
so the entire Netty artifact set resolves to a single consistent
version (4.2.15.Final). The CVE-2026-42583 fix present in the
previous 4.1.x pin is also included in 4.2.15.Final.

JIRA:LMCROSSITXSADEPLOY-3410
---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index b58c275a4c..d7ad3463c5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,8 +38,8 @@
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
         <reactor-netty.version>1.3.6</reactor-netty.version>
-        <!-- Override Netty version to fix CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
-        <netty.version>4.1.135.Final</netty.version>
+        <!-- Override Netty version; aligns with reactor-netty ${reactor-netty.version} and fixes CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
+        <netty.version>4.2.15.Final</netty.version>
         <swagger.version>1.6.16</swagger.version>
         <jclouds.version>2.7.0</jclouds.version>
         <guava.version>33.5.0-jre</guava.version>

From 1f4f4d5ec63f1a8b801b7405ebb17bbbf2d9732a Mon Sep 17 00:00:00 2001
From: Yavor16 <yavoruzbg@gmail.com>
Date: Wed, 15 Jul 2026 13:27:18 +0300
Subject: [PATCH 3/5] fix: add comment documenting reactor-netty OOM resolution
 for LMCROSSITXSADEPLOY-3410

JIRA:LMCROSSITXSADEPLOY-3410
---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index d7ad3463c5..856e66849d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,6 +37,7 @@
         <liquibase.version>4.33.0</liquibase.version>
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
+        <!-- reactor-netty 1.3.x direct-memory OOM (previously pinned to 1.2.x) resolved upstream; see reactor-netty#<issue> -->
         <reactor-netty.version>1.3.6</reactor-netty.version>
         <!-- Override Netty version; aligns with reactor-netty ${reactor-netty.version} and fixes CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
         <netty.version>4.2.15.Final</netty.version>

From e6175c80e0b84c7d2a0e0e357dc651d7cbe9042f Mon Sep 17 00:00:00 2001
From: Yavor16 <yavoruzbg@gmail.com>
Date: Wed, 15 Jul 2026 13:52:05 +0300
Subject: [PATCH 4/5] fix: remove unresolvable issue placeholder from
 reactor-netty OOM comment

JIRA:LMCROSSITXSADEPLOY-3410
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 856e66849d..0d36483385 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,7 +37,7 @@
         <liquibase.version>4.33.0</liquibase.version>
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
-        <!-- reactor-netty 1.3.x direct-memory OOM (previously pinned to 1.2.x) resolved upstream; see reactor-netty#<issue> -->
+        <!-- reactor-netty 1.3.x direct-memory OOM (previously pinned to 1.2.x) resolved upstream in the 1.3.x release line -->
         <reactor-netty.version>1.3.6</reactor-netty.version>
         <!-- Override Netty version; aligns with reactor-netty ${reactor-netty.version} and fixes CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
         <netty.version>4.2.15.Final</netty.version>

From 9919c99d6a014d99e7aefe9eb6148c2bbb064062 Mon Sep 17 00:00:00 2001
From: Yavor16 <yavoruzbg@gmail.com>
Date: Thu, 16 Jul 2026 16:00:09 +0300
Subject: [PATCH 5/5] Remove not required dependencies

---
 pom.xml | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0d36483385..568caf8578 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,9 +37,7 @@
         <liquibase.version>4.33.0</liquibase.version>
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
-        <!-- reactor-netty 1.3.x direct-memory OOM (previously pinned to 1.2.x) resolved upstream in the 1.3.x release line -->
         <reactor-netty.version>1.3.6</reactor-netty.version>
-        <!-- Override Netty version; aligns with reactor-netty ${reactor-netty.version} and fixes CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
         <netty.version>4.2.15.Final</netty.version>
         <swagger.version>1.6.16</swagger.version>
         <jclouds.version>2.7.0</jclouds.version>
@@ -293,14 +291,6 @@
     </dependencies>
     <dependencyManagement>
         <dependencies>
-            <!-- Override Netty version to fix CVE-2026-42583 -->
-            <dependency>
-                <groupId>io.netty</groupId>
-                <artifactId>netty-bom</artifactId>
-                <version>${netty.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>
@@ -870,16 +860,6 @@
                 <artifactId>reactor-netty</artifactId>
                 <version>${reactor-netty.version}</version>
             </dependency>
-            <dependency>
-                <groupId>io.projectreactor.netty</groupId>
-                <artifactId>reactor-netty-core</artifactId>
-                <version>${reactor-netty.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>io.projectreactor.netty</groupId>
-                <artifactId>reactor-netty-http</artifactId>
-                <version>${reactor-netty.version}</version>
-            </dependency>
             <!-- https://mvnrepository.com/artifact/org.cloudfoundry.multiapps/multiapps-common -->
             <dependency>
                 <groupId>org.cloudfoundry.multiapps</groupId>